EP3772839A1 - Security module for a serial communications device - Google Patents
Security module for a serial communications device Download PDFInfo
- Publication number
- EP3772839A1 EP3772839A1 EP19190344.2A EP19190344A EP3772839A1 EP 3772839 A1 EP3772839 A1 EP 3772839A1 EP 19190344 A EP19190344 A EP 19190344A EP 3772839 A1 EP3772839 A1 EP 3772839A1
- Authority
- EP
- European Patent Office
- Prior art keywords
- error
- signal
- identifier
- bus
- node
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000004891 communication Methods 0.000 title claims abstract description 98
- 238000001514 detection method Methods 0.000 claims abstract description 8
- 238000000034 method Methods 0.000 claims description 14
- 230000004048 modification Effects 0.000 description 6
- 238000012986 modification Methods 0.000 description 6
- 230000000246 remedial effect Effects 0.000 description 6
- 230000007246 mechanism Effects 0.000 description 4
- 230000001052 transient effect Effects 0.000 description 3
- 230000009471 action Effects 0.000 description 2
- 230000008901 benefit Effects 0.000 description 2
- 238000011161 development Methods 0.000 description 2
- 230000018109 developmental process Effects 0.000 description 2
- 238000004519 manufacturing process Methods 0.000 description 2
- 238000012545 processing Methods 0.000 description 2
- 230000011664 signaling Effects 0.000 description 2
- 230000009286 beneficial effect Effects 0.000 description 1
- 230000005540 biological transmission Effects 0.000 description 1
- 230000008878 coupling Effects 0.000 description 1
- 238000010168 coupling process Methods 0.000 description 1
- 238000005859 coupling reaction Methods 0.000 description 1
- 125000004122 cyclic group Chemical group 0.000 description 1
- 230000006870 function Effects 0.000 description 1
- 230000003993 interaction Effects 0.000 description 1
- 230000008520 organization Effects 0.000 description 1
- 230000008569 process Effects 0.000 description 1
- 230000035484 reaction time Effects 0.000 description 1
- 230000001960 triggered effect Effects 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
- H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L1/00—Arrangements for detecting or preventing errors in the information received
- H04L1/004—Arrangements for detecting or preventing errors in the information received by using forward error control
- H04L1/0056—Systems characterized by the type of code used
- H04L1/0061—Error detection codes
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F13/00—Interconnection of, or transfer of information or other signals between, memories, input/output devices or central processing units
- G06F13/38—Information transfer, e.g. on bus
- G06F13/42—Bus transfer protocol, e.g. handshake; Synchronisation
- G06F13/4282—Bus transfer protocol, e.g. handshake; Synchronisation on a serial bus, e.g. I2C bus, SPI bus
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/08—Error detection or correction by redundancy in data representation, e.g. by using checking codes
- G06F11/10—Adding special bits or symbols to the coded information, e.g. parity check, casting out 9's or 11's
- G06F11/1004—Adding special bits or symbols to the coded information, e.g. parity check, casting out 9's or 11's to protect a block of data words, e.g. CRC or checksum
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
- G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
- G06F21/74—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information operating in dual or compartmented mode, i.e. at least one secure mode
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L1/00—Arrangements for detecting or preventing errors in the information received
- H04L1/004—Arrangements for detecting or preventing errors in the information received by using forward error control
- H04L1/0072—Error control for data other than payload data, e.g. control data
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
Definitions
- the present disclosure relates to a security module for a serial communications device, such as in controller area networks.
- CAN controller area network
- ECUs electronice control units
- ECUs engine control module
- PCM power train control module
- airbags airbags
- antilock brakes cruise control
- electric power steering audio systems
- windows doors
- mirror adjustment battery and recharging systems for hybrid/electric cars
- ISO International Standards Organization
- CAN FD CAN Flexible Data-Rate
- CAN XL A next generation CAN protocol termed CAN XL is also under development.
- serial communications networks include for example- Local Interconnect Network (LIN).
- LIN Local Interconnect Network
- a security module for a serial communications device comprising:
- Providing such an error-signal can enable more detailed information about the condition to be communicated to nodes on the bus, such that remedial action can be taken that is appropriate for the specific condition that has been violated.
- the one or more parameters relating to the condition can take one of at least three different values.
- the error-signal comprises an error-identifier of one or more conditions that have been violated.
- the security module is associated with a serial communications node.
- the error-signal may comprise a node-identifier of the serial communications node.
- the error-signal comprises a security-module-identifier of the security module.
- the security module is configured to:
- the security module is configured to:
- the error-check-signal comprises one or more dominant bits if there is a difference between the error-signal and the bus-error-signal.
- the error-signal may comprise: a first-identifier relating to the condition; and a second-identifier relating to the condition.
- the bus-error-signal may comprise: a bus-first-identifier relating to the condition; and a bus-second-identifier relating to the condition.
- the error-check-signal may comprise: a first-error-check-signal, which is indicative of whether or not there is a difference between: (i) the first-identifier of the error-signal; and (ii) the bus-first-identifier of the bus-error-signal; and / or a second-error-check-signal, which is indicative of whether or not there is a difference between: (i) the second-identifier of the error-signal; and (ii) the bus-second-identifier of the bus-error-signal.
- the security module may be associated with a serial communications node.
- the first-identifier may comprise a node-identifier of the serial communications node.
- the bus-first-identifier may comprise a bus-node-identifier of one or more serial communications nodes.
- the second-identifier may comprise an error-identifier of one or more conditions that have been violated.
- the bus-second-identifier may comprise a bus-error-identifier of one or more conditions that have been violated.
- the error-signal comprises a plurality of bit positions. Each of the bit positions may uniquely identify a particular condition or a particular node-identifier.
- the security module is associated with a serial communications node.
- the error-signal may comprise a node-identifier of the serial communications node.
- the node-identifier may comprise a plurality of bit positions. Each of the bit positions of the node-identifier may uniquely identify a particular node.
- the error-signal may comprise an error-identifier of one or more s that have been violated.
- the error-identifier may comprise a plurality of bit positions. Each of the bit positions of the error-identifier may uniquely identify a particular condition.
- the error-signal comprises a plurality of bit positions.
- the error-signal may comprise a dominant bit value at a predetermined bit position.
- the predetermined bit position is the first bit position.
- the serial communications device in a CAN XL node in a CAN XL node.
- the serial communications bus may be a CAN XL bus.
- a method of outputting an error-signal to a serial communications bus comprising:
- FIG. 1 depicts a CAN network 100 that includes multiple CAN nodes 102, also referred to as ECUs, each connected to a CAN bus 104.
- each CAN node 102 includes a CAN transceiver 120, a local controller 110, or microcontroller, having an embedded CAN protocol controller 114.
- the local controllers 110 are typically connected to at least one device (not shown) such as a sensor, an actuator, or some other control device and are programmed to determine the meaning of received messages and to generate appropriate outgoing messages.
- the local controllers may also be referred to as host processors, hosts, or digital signal processors (DSPs).
- the host supports application software that interacts with the CAN protocol controller 114.
- the CAN protocol controllers 114 which can be embedded within the local controllers 110 or external to the local controllers (e.g., a separate IC device), implement data link layer operations. For example, in receive operations, a CAN protocol controller 114 stores received serial bits from the transceiver 120 until an entire message is available for fetching by the local controller 110. The CAN protocol controller 114 can also decode CAN messages according to the standardized frame formats of the CAN protocol. In transmit operations, the CAN protocol controller 114 receives messages from the local controller and transmits the messages as serial bits in one of the CAN frame formats to the CAN transceiver 120.
- the CAN transceivers 120 are located between the CAN protocol controllers 114 and the CAN bus 104 and implement physical layer operations. For example, in receive operations, a CAN transceiver 120 converts analog differential signals from the CAN bus to serial digital signals that the CAN protocol controller 114 can interpret. The CAN transceiver also protects the CAN protocol controller 114 from extreme electrical conditions on the CAN bus 104, e.g., electrical surges. In transmit operations, the CAN transceiver 120 converts serial digital bits received from the CAN protocol controller 114 into analog differential signals that are sent on the CAN bus 104.
- the CAN bus 104 carries analog differential signals and includes a CAN high (CANH) bus line 124 and a CAN low (CANL) bus line 126.
- CANH CAN high
- CANL CAN low
- Figure 2 depicts an expanded view of one CAN node 202.
- Features of Figure 2 that are also shown in Figure 1 have been given corresponding reference numbers in the 200 series and will not necessarily be described again here.
- the local controller 210 includes a host 216, which may be, for example, a software application that is stored in memory of the local controller 210 and executed by processing circuits of the local controller 210.
- the local controller 210 and the CAN transceiver 220 of the CAN node 202 are connected between a supply voltage, Vcc, and ground, GND. In some examples, the local controller 210 and the CAN transceiver 220 may have different supply voltages.
- data communicated from the local controller 210 to the CAN transceiver 220 is identified as transmit data (TXD) and data communicated from the CAN transceiver 220 to the local controller 210 is referred to as receive data (RXD). Data is communicated to and from the CAN bus via the CANH and CANL bus lines 224 and 226, respectively.
- Figure 3 depicts the format of an ISO 11898-1 frame 330 (in the classical base frame format (CBFF) or standard format) that is used in CAN normal mode and also the format of an ISO/DIS 11898-1 frame 332 (in the FD base frame format or FBFF) that is used in CAN FD mode.
- CBFF classical base frame format
- FBFF FD base frame format
- CEFF classical extended frame format
- FEFF FD extended frame format
- the CAN protocols use the reserved bit (r0 or r1) (also referred to generally as the FDF bit) within a CAN frame to identify a frame as a CAN FD mode frame.
- the FDF bit is a 1-bit field that indicates whether the frame is a CAN normal mode frame or a CAN FD mode frame.
- the frame When the FDF bit is dominant (e.g., low or "0"), the frame is a CAN normal mode frame and when the FDF bit is recessive (e.g., high or "1"), the frame is a CAN FD mode frame. In a CAN normal mode frame, the reserved bits (r0, r1) are always driven dominant to the bus lines.
- CAN messages are broadcast messages and the identifier is unique to the sender CAN node.
- the CAN protocol controllers of the receiving CAN nodes have identifier filters that are "tuned" to certain identifiers to make sure that the host receives relevant messages and is not bothered with irrelevant messages.
- Standard CAN frames have an 11-bit IDENTIFIER field to carry an 11-bit identifier and extended CAN frames have a 29-bit IDENTIFIER field to carry a 29-bit identifier.
- the 29-bit IDENTIFIER field is divided into two sections, an 11-bit base IDENTIFIER field and an 18-bit extended IDENTIFIER field.
- FIG. 4A depicts a CAN node 402 including a security module 434 according to an embodiment of the present disclosure.
- the security module 460 is provided separately to a CAN transceiver 420 and a CAN local controller 410.
- the security module 460 is located in a data path between the CAN transceiver 420 and the CAN local controller 410.
- FIG. 4B depicts a CAN node 402 including a security module 460 according to another embodiment of the present disclosure.
- the security module 460 is provided as part of the CAN local controller 410.
- the functionality of the security module 460 can be provided by a CAN protocol controller.
- the functionality of the security module 460 can be provided by the CAN transceiver 420. This can improve the security of the network even further.
- the CAN node 402 includes a CAN transceiver 420 and a local CAN controller 410 as described above with reference to Figures 1 and 2 .
- the CAN transceiver 420 is connected to a CAN bus 404.
- the CAN bus 404 is an example of a serial communications bus
- the CAN node 402 is an example of a serial communications device / node
- the CAN transceiver 420 is an example of a serial communications transceiver.
- examples disclosed herein can relate to a Classical CAN node, a CAN FD node, a CAN XL node, or any other CAN node that satisfies an associated CAN standard, either now or in the future.
- embodiments of the security module that are described herein are not limited to CAN protocols, as they can be used with other serial communications protocols / networks such as LIN.
- the security module 434 is shown separately from the CAN transceiver 420 and the local controller 410. It will be appreciated that in other examples the functionality of the security module 434 can be provided by the CAN transceiver 420 and / or the local controller 410.
- the security module 434 includes a receive data, RXD, input interface 436 for receiving data from the CAN bus 404.
- the security module 434 also includes a transmit data, TXD, output interface 438 for transmitting data to the CAN bus 404.
- the security module 434 can receive a message from the CAN bus 404 via the RXD input interface 436, and compare the message with one or more conditions.
- the conditions can include one or more of form errors, stuff errors and policy violations, as non-limiting examples. For instance a policy may be violated if the security module determines that the CAN message is being spoofed.
- form errors and stuff errors are known in the art.
- the security module 434 can output an error-signal to the CAN bus 404 via the TXD output interface 438. In this way, the security module 434 can perform one or more of: identifying form errors and / or stuff errors; and determining that a policy has been violated.
- the error-signal identifies one or more parameters relating to the condition. That is, the error-signal comprises information about the error signal, such that it is more than a mere binary flag that indicates only whether or not a condition has been violated.
- a serial communications protocol such as CAN
- One or more of the examples described herein can be beneficial over solutions that require the interaction of the lower and higher layers of the protocol; where the lower layer reports the reason for the n-ack to a higher layer, which then in turn can trigger a next message that conveys the information. This would require more bandwidth and add to the reaction time after an incident has happened.
- the error-signal of the present disclosure can include an error-identifier of one or more conditions that have been violated.
- an example of a parameter is a reason that an error-signal has been generated.
- the error-signal can include a security-module-identifier of the security module that has detected that one or more conditions have been violated.
- the identifier may be a node-identifier of the CAN node 420 with which the security module 434 is associated.
- another example of a parameter is the originator of the error-signal.
- any of these parameters can take one of at least three different values - that is, they are more than mere binary flags. As will be discussed in detail below, this can be embodied by using digital error-signals that include a plurality of bit positions.
- the security module 434 can output an error-check-signal on to the CAN bus 404, which may be a bit field at the end of the frame such as after the error-signal.
- the error-check-signal can indicate the authenticity of a bus-error-signal on the CAN bus 404.
- the bus-error-signal is a combination of all of the error-signals that have been put onto the CAN bus 404 by individual CAN nodes.
- the error-check-signal can advantageously provide an indicator as to whether or not any such over-writing (or other manipulation) of an original error-signal has occurred.
- the following examples relate to a serial communication protocol where a security module associated with a node can receive data from a serial communications bus at a RXD input interface, and can transmit data to the serial communications bus via a TXD output interface.
- Messages on the serial communications bus have an end-of-frame field.
- the bit timing can be the bit timing of an arbitration phase.
- the behaviour of the physical layer is as in the arbitration phase; so dominant bits ("0") overwrite recessive bits ("1").
- This information can be sent by multiple nodes.
- the information and its usage can be defined by the user. What is important is that the message can be discarded on the data link layer and the information can be handed to higher protocol layers.
- Figure 5 shows data 539 that a node sends on to a serial communications bus.
- the data 539 includes a message 540 that comprises message bits "x", and an EOF (end of frame field) with recessive bits "e".
- the recessive bits are 1s.
- Figure 5 also shows data 541 that is put on to the serial communications bus by node 5, which is a different node to the one that sent the message 540.
- Node 5 has a security module that has compared the received message 540 with one or more conditions, in this example security policies, and detected that a security policy has been violated.
- node 5 has determined that security policy number 7 has been violated. That is, the received message 540 does not satisfy policy number 7.
- Policy number 7 may be specific to node 5, or may be a generic policy that applies to multiple nodes, possibly all of the nodes. Node 5 therefore outputs an error-signal 543 to the serial communications bus.
- the error-signal 543 comprises a node-identifier 544 that is associated with the serial communications node that detected the condition.
- the node-identifier 544 is a binary representation of 5; that is the identification number of node 5.
- the identifier of the node (or security module) that detected the violation of the error signal is an example of a parameter relating to the error.
- the error-signal 543 also comprises an error-identifier 545 that is associated with the condition that has been violated.
- condition number 7 has been violated and the error-identifier 545 is a binary representation of 7.
- the identifier of the condition that has been violated is an example of a parameter relating to the condition.
- Node 5 also provides an optional error-check-signal 546 to the bus, which will be discussed in more detail with reference to later examples. After the error-check-signal 546, node 5 puts recessive bits 1s on the bus to indicate that it is ready to receive or send a new message.
- Figure 5 shows the resultant data 542 on the serial communications bus, which includes a bus error-signal 555.
- the bus error-signal 555 includes a bus-node-identifier 552 and a bus-error-identifier 553. In this example it is a combination of the message 540, the error-signal 543 and the error-check-signal 546.
- all nodes can determine that:
- Figure 6 shows data 639 that a node sends on to a serial communications bus.
- the data 639 includes a message 640.
- Figure 6 also shows data 641 that is put on to the serial communications bus by node 5.
- Node 5 outputs an error-signal 643 to the serial communications bus, in the same way as for Figure 5 . That is, Node 5 has again determined that condition number 7 has been violated.
- the error signal includes a node-identifier 644 and an error-identifier 645.
- Figure 6 also shows data 647 that is put on to the serial communications bus by node 3, which is again a different node to the one that sent the message 640.
- Node 3 has a security module that has compared the received message 640 with one or more conditions and has also detected that condition number 7 has been violated.
- Node 3 therefore outputs an error-signal 648 to the serial communications bus.
- the error-signal 648 includes a node-identifier 649 that identifies node 3 as the node that detected the condition, and also includes an error-identifier 650 that is associated with condition number 7.
- Figure 6 shows the resultant data 642 on the serial communications bus.
- the message 640 the error-signal 643 provided by node 5, and the error-signal 648 provided by node 3. It is recalled that 0 is dominant over 1 in the protocol of this example, and therefore for bit positions in the two error-signals where nodes 3 and 5 provide different bit values, the dominant value of 0 will appear on the bus.
- the second and third positions of the node-identifier 644 of node 5 and the node-identifier 649 of node 3 are different.
- these node-identifiers are combined on the bus, it results in a bus-node-identifier 652 of 0001, which is a binary representation of decimal 1. Therefore, the bus-node-identifier 652 does not correctly reflect which nodes have detected the error.
- both node 3 and node 5 have detected the same error. Therefore, the error-identifier 645 that was provided by node 5 is the same as the error-identifier 653 that was provided by node 3. When these error-identifiers are combined on the bus, it results in a bus-error-identifier 653 which correctly reflects the condition that has been violated.
- bus-node-identifier 652 and the bus-error-identifier 653 can together be referred to as a bus error-signal 655.
- Node 5 also provides an error-check-signal 646 to the bus.
- node 3 provides an error-check-signal 651 to the bus.
- security modules associated with each of the node sets their error-check-signals 646, 651 to indicate whether or not the bus-error-signal 655 on the bus correctly reflects the locally generated error-signal 643, 648.
- the security module associated with node 5 can compare (i) the error-signal 643 that it outputs to the bus via its TXD output interface; with (ii) the bus-error-signal 655 that it receives via its RXD input interface. The security module can then output the error-check-signal 646 to the bus via the TXD output interface.
- the error-check-signal 646 is indicative of whether or not there is a difference between the locally generated error-signal 643 and the bus-error-signal 655.
- an error-check-signal 646 comprises one or more dominant bits if there is a difference between the error-signal 643 and the bus-error-signal 655.
- the error-signals 643, 648 in Figure 6 identify both a first parameter and a second parameter relating to the condition.
- the first parameter is an identifier of the node that detected the violation of the error, and is represented by the node-identifiers 644, 649.
- the second parameter is an identifier of the condition that has been violated, and is represented by the error-identifiers 645, 650.
- the resulting bus-error-signal 655 includes the bus-node-identifier 652 and the bus-error-identifier 653.
- the security module associated with node 5 can compare the locally generated node-identifier 644 with the bus-node-identifier 652, and can also separately compare the locally generated error-identifier 645 with the bus-error-identifier 653. As will be discussed below, the security module can provide the results of these separate comparisons in the error-check-signal 646 such that they are discernible from each other-for example by including the information at predetermined bit positions. The other nodes in the network can then correctly interpret the information at these bit positions because they are also programmed in accordance with the predetermined bit positions.
- the error-check-signal 646 can comprise a first-error-check-signal, which is indicative of whether or not there is a difference between a first-identifier of the error-signal and a bus-first-identifier of the bus-error-signal.
- the first-identifier of the error-signal is a node-identifier
- the bus-first-identifier is the bus-node-identifier
- the first-error-check-signal is implemented as the first bit-position of the error-check-signal 646.
- the error-check-signal 646 can comprise a second-error-check-signal, which is indicative of whether or not there is a difference between a second-identifier of the error-signal and a bus-second-identifier of the bus-error-signal.
- the second-identifier of the error-signal is an error-identifier
- the bus-second-identifier is the bus-error-identifier
- the second-error-check-signal is implemented as the second bit-position of the error-check-signal 646.
- node 5 determines that there is a difference between its locally generated node-identifier 644 and the bus-node-identifier 652, and therefore sets the first bit value of the error-check-signal 646 as a dominant 0.
- Node 5 also determines that its locally generated error-identifier 645 is the same as the bus-error-identifier 653, and therefore sets the second bit value of the error-check-signal 646 as a recessive 1.
- Node 3 determines that there is a difference between its locally generated node-identifier 649 and the bus-node-identifier 652, and therefore sets the first bit value of the error-check-signal 651 as a dominant 0.
- Node 3 also determines that its locally generated error-identifier 650 is the same as the bus-error-identifier 653, and therefore sets the second bit value of the error-check-signal 651 as a recessive 1.
- bus-error-check-signal 654 which indicates that: the bus-node-identifier 652 does not accurately reflect which node detected the violation of the condition; and (ii) the bus-error-identifier 653 does accurately reflect the identity of the condition that has been violated.
- all nodes can determine that:
- Figure 7 shows data 739 that a node sends on to a serial communications bus.
- the data 739 includes a message 740.
- Figure 7 also shows data 741 that is put on to the serial communications bus by node 5.
- Node 5 outputs the same error-signal 743 as that shown for Figure 6 .
- Figure 7 also shows data 747 that is put on to the serial communications bus by node 3.
- Node 3 outputs an error-signal 748 to the serial communications bus.
- the error-signal 748 includes the same node-identifier 749 as shown in Figure 6 , but a different error-identifier 750.
- the error-identifier 750 is associated with condition number 1.
- Figure 7 shows the resultant data 742 on the serial communications bus.
- the second and third positions of the error-identifier 745 of node 5 and the error-identifier 750 of node 3 are different.
- these error-identifiers 745, 750 are combined on the bus, it results in a bus-error-identifier 753 of 0001, which is a binary representation of decimal 1. Therefore, the bus-error-identifier 753 does not correctly reflect the conditions that have been violated.
- bus-node-identifier 752 also does not correctly reflect which nodes have detected the error.
- Node 5 provides an error-check-signal 746 to the bus.
- This error-check-signal 746 includes a first-error-check-signal (at the first bit position), which indicates that there is a difference between its locally generated node-identifier 744 and the bus-node-identifier 752.
- the error-check-signal 746 also includes a second-error-check-signal (at the second bit position), which indicates that there is a difference between its locally generated error-identifier 745 and the bus-error-identifier 753.
- Node 3 also provides an error-check-signal 751 to the bus.
- This error-check-signal 751 includes a first-error-check-signal (at the first bit position), which indicates that there is a difference between its locally generated node-identifier 749 and the bus-node-identifier 752.
- the error-check-signal 751 also includes a second-error-check-signal (at the second bit position), which indicates that its locally generated error-identifier 750 is the same as the bus-error-identifier 753.
- bus-error-check-signal 754 which indicates that: the bus-node-identifier 752 does not accurately reflect which node detected the violation of the condition; and (ii) the bus-error-identifier 753 does not accurately reflect the identity of the condition that has been violated.
- all nodes can determine that:
- Figure 8 shows data 839 that a node sends on to a serial communications bus.
- the data 839 includes a message 840.
- Figure 8 also shows data 841 that is put on to the serial communications bus by node 5, and also data 847 that is put on to the serial communications bus by node 3.
- nodes 3 and 5 put error-signals 843, 848 on to the bus in a different format to that described above.
- the error-signals 843, 848 comprise a plurality of bit positions, and each of the bit positions uniquely identifies a particular condition or a particular node-identifier.
- Node 5's error-signal 843 includes a node-identifier 844.
- the node-identifier 844 has six bit positions, which each uniquely identify a particular node.
- the security module associated with any one node can only set one of the bit positions of the node-identifier 844 to a dominant 0. For instance, a security module associated with a first node can set a first bit position of the node-identifier 844 to a dominant 0 if it detects that a condition has been violated, but it cannot set any of the other bit positions of the of the node-identifier 844.
- a security module associated with a second node can set a second bit position of the node-identifier 844 to a dominant 0 if it detects that a condition has been violated, but it cannot set any of the other bit positions of the of the node-identifier 844. Et cetera .
- the fifth bit position of the node-identifier 844 has been set to a dominant 0 to indicate that node 5 has detected the error.
- Node 5's error-signal 843 also includes an error-identifier 845.
- the error-identifier 845 has eight bit positions, which each uniquely identify a particular condition that can be detected.
- a security module can set one or more of the bit positions of the error-identifier 845 to a dominant 0 if it detects the violation of an associated condition. For instance, if a security module detects violation of a first condition then it sets the first bit position of the error-identifier 845 to a dominant 0. If a security module detects violation of a second condition then it sets the second bit position of the error-identifier 845 to a dominant 0. Et cetera.
- the seventh bit position of the error-identifier 845 has been set to a dominant 0 to indicate that condition 7 has been violated.
- Node 3's error-signal 848 also includes a node-identifier 849 and an error-identifier 850. As shown in Figure 8 , the third bit position of the node-identifier 849 has been set to a dominant 0 to indicate that node 3 has detected the error. The first bit position of the error-identifier 850 has been set to a dominant 0 to indicate that condition 1 has been violated.
- Figure 8 shows the resultant data 842 on the serial communications bus.
- the resultant bus-error-signal 855 retains identifiers of which nodes detected errors and which errors were detected.
- One or more of the nodes can store a correlation between the bit position in a node-identifier and an identifier of the associated node. In some examples, this can enable a node to take remedial action that is specific to the node that detected the error.
- One or more of the nodes can also store a correlation between the bit position in an error-identifier 845 and an identifier of an associated condition. In some examples, this can enable a node to take remedial action that is specific to the errors that have been detected. Examples of remedial action that can be taken are described in more detail below.
- the error-check-signals 846, 851 are used differently to their use in the earlier examples. This is because the bit positions of the error-signals 843, 848 uniquely identify a particular error condition or a particular node-identifier. Therefore, in determining whether to set the error-check-signals 846, 851 as 1 or 0, a node can compare (i) the value of a particular bit position of the error-signal 843, 848 that it outputs to the bus via its TXD output interface; with (ii) the value of the same bit position of the bus-error-signal 855 that it receives via its RXD input interface.
- node 5 In relation to the node-identifier 844 of node 5's error-signal 843, the 5 th bit position of the node-identifier 844 is uniquely associated with node 5. Therefore, no other node should be able to set the 5 th bit position of the bus-node-identifier 852 of the error-signal 855 on the bus. In order to determine whether or not to set the first bit of the error-check-signal 846, node 5 compares (i) the value of the 5 th bit position of the node-identifier 844; with (ii) the value of the 5 th bit position of the bus-node-identifier 852.
- the 5 th bit position of both the node-identifier 844 and the bus-node-identifier 852 is a 0. Therefore, the node determines that the value that it has put onto the bus for its unique bit position in the node-identifier 844 is accurately reflected in the bus-node-identifier 852, and it sets the first bit of the error-check-signal 846 as 1. If the node determined that the value that it had put onto the bus for its unique bit position in the node-identifier 844 was not accurately reflected in the bus-node-identifier 852, then it would set the first bit of the error-check-signal 846 as a dominant 0.
- node 3 determines that the value of the 3 rd bit of its node-identifier 849 correctly matches the value of the 3 rd bit of the bus-node-identifier 852 and therefore also sets the first bit of its error-check-signal 851 as 1.
- any node detects a dominant 0 in the first bit position of the bus-error-check-signal 854, then the nodes can take any of the actions described elsewhere in this document in relation to the detection of a dominant 0 in an error-check-signal.
- the second bit position of the error-check-signals 846, 851, 854 can be used when each bit position of the error-identifiers 845, 850 is uniquely associated with an error condition that only a single node can detect.
- the nodes can set the value of the second bit positions of the error-check-signals 846, 851 in a similar way as the first bit positions as described above, by comparing the value of a particular bit position of an error-identifier; with (ii) the value of the same bit position of the bus-error-identifier.
- the error-check-signals 846, 851, 854 may not be required because it is still possible to discern the identifiers of which nodes detected errors and which errors were detected from the bus-error-signal 855.
- all nodes can determine that:
- a bus-error-check-signal 854 can be used to indicate whether or not a modification has been made to an error-signal that has been sent by a security module, which can be used as a flag that indicates that more than one node is sending an error-signal.
- Figure 9 is an example that is very similar to Figure 8 .
- the error-signals 943, 948 that are transmitted onto the bus include a dominant bit value at a predetermined bit position 956.
- the predetermined bit position 956 is the first bit position, and can be considered as representing an error-flag.
- the error-flag does not identify the node that detected the error, nor does it indicate the condition that has been violated. Instead, the error-flag can be considered as putting the nodes in the network on notice that an error has been detected and that further information about one or more parameters relating to the condition will follow.
- error-flag can be advantageous where the number of bits in an error-signal is high, and thus in a worst case scenario the first dominant bit in the error-signal could occur later than the end of the EOF field.
- the error-flag can be included at any predetermined bit position 956 that is before the end of the EOF field for a particular protocol. The error-flag is only set to a dominant value by a node if there will be subsequent dominant bits in the error-signal.
- a further advantage of the error-flag is that it can help to ensure better synchronicity of senders and receivers on the bus.
- the security module or an associated controller may perform one or more of the following remedial actions:
- the remedial action that is taken can be automatically selected by a processor or module based on a bus-node-identifier and / or a bus-error-identifier (or more generally a bus-error-signal).
- Examples described herein can add a signalling at the end of a serial data frame that is used to force all receivers to discard the message, whereby the sender of such discard signal may be different from the sender of the serial data frame.
- the sender of the discard signal can encode the reason why the message is to be discarded into the discard signal and can flag modifications of the discard signal by e.g. rogue nodes.
- Figure 10 illustrates an example embodiment of a method of outputting an error-signal to a serial communications bus.
- the serial communications bus may or may not be a CAN XL bus.
- the method comprises receiving a message from the serial communications bus (404).
- the message can be sent by any node on the bus.
- the method can involve determining whether or not the received message was sent from the local host or not. If the message was sent by the local host / node, then it may apply different or additional conditions than would be the case if the message had been received by a remote host / node. For instance, one or more policies may only be checked to see if they have been violated for a remotely received message that has the identifier of the local host / node.
- the method includes comparing the message with one or more conditions.
- conditions can relate to stuff errors, form errors, intrusion errors, scheduling errors, policy violations, or any other types of error / policies that are known in the art.
- the method comprises outputting an error-signal to the serial communications bus.
- the error-signal identifies one or more parameters relating to the condition, which can include an identifier of a node that has detected the error and / or an identifier of the condition that has been violated.
- One or more of the examples disclosed herein can provide a mechanism to invalidate a frame / message by a cyber or safety function, where one does not already exist, such as in CAN XL. Also, examples described herein can provide a mechanism for identifying which node detected an error and / or for what reason the message shall be discarded to receivers and transmitters on a serial communications network.
- the set of instructions/method steps described above are implemented as functional and software instructions embodied as a set of executable instructions which are effected on a computer or machine which is programmed with and controlled by said executable instructions. Such instructions are loaded for execution on a processor (such as one or more CPUs).
- processor includes microprocessors, microcontrollers, processor modules or subsystems (including one or more microprocessors or microcontrollers), or other control or computing devices.
- a processor can refer to a single component or to plural components.
- the set of instructions/methods illustrated herein and data and instructions associated therewith are stored in respective storage devices, which are implemented as one or more non-transient machine or computer-readable or computer-usable storage media or mediums.
- Such computer-readable or computer usable storage medium or media is (are) considered to be part of an article (or article of manufacture).
- An article or article of manufacture can refer to any manufactured single component or multiple components.
- the non-transient machine or computer usable media or mediums as defined herein excludes signals, but such media or mediums may be capable of receiving and processing information from signals and/or other transient mediums.
- Example embodiments of the material discussed in this specification can be implemented in whole or in part through network, computer, or data based devices and/or services. These may include cloud, internet, intranet, mobile, desktop, processor, look-up table, microcontroller, consumer equipment, infrastructure, or other enabling devices and services. As may be used herein and in the claims, the following non-exclusive definitions are provided.
- one or more instructions or steps discussed herein are automated.
- the terms automated or automatically mean controlled operation of an apparatus, system, and/or process using computers and/or mechanical/electrical devices without the necessity of human intervention, observation, effort and/or decision.
- any components said to be coupled may be coupled or connected either directly or indirectly.
- additional components may be located between the two components that are said to be coupled.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Theoretical Computer Science (AREA)
- General Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- Signal Processing (AREA)
- Computer Networks & Wireless Communication (AREA)
- Computer Hardware Design (AREA)
- General Physics & Mathematics (AREA)
- Computing Systems (AREA)
- Mathematical Physics (AREA)
- Software Systems (AREA)
- Quality & Reliability (AREA)
- Small-Scale Networks (AREA)
Abstract
Description
- The present disclosure relates to a security module for a serial communications device, such as in controller area networks.
- One example of a serial communications network is a controller area network (CAN), which is a message-based communications bus protocol that is often used within automobiles. The CAN bus protocol is used to enable communications between various electronic control units (ECUs), such as an engine control module (ECM), a power train control module (PCM), airbags, antilock brakes, cruise control, electric power steering, audio systems, windows, doors, mirror adjustment, battery and recharging systems for hybrid/electric cars, and many more. The data link layer of the CAN protocol is standardized as International Standards Organization (ISO) 11898-1. The standardized CAN data link layer protocol has also been extended to provide higher data rates. The extended protocol, referred to as CAN Flexible Data-Rate or "CAN FD," is part of the ISO 11898-1:2015 version of the standard. A next generation CAN protocol termed CAN XL is also under development.
- Other types of serial communications networks are known, and include for example- Local Interconnect Network (LIN).
- According to a first aspect of the present disclosure there is provided a security module for a serial communications device, the security module comprising:
- a receive data, RXD, input interface for receiving data from a serial communications bus;
- a transmit data, TXD, output interface for transmitting data to the serial communications bus;
- wherein the security module is configured to:
- receive a message from the serial communications bus via the RXD input interface;
- compare the message with one or more conditions; and
- upon detection that a condition has been violated, output an error-signal to the serial communications bus via the TXD output interface, wherein the error-signal identifies one or more parameters relating to the condition.
- Providing such an error-signal can enable more detailed information about the condition to be communicated to nodes on the bus, such that remedial action can be taken that is appropriate for the specific condition that has been violated.
- In one or more embodiments, the one or more parameters relating to the condition can take one of at least three different values.
- In one or more embodiments, the error-signal comprises an error-identifier of one or more conditions that have been violated.
- In one or more embodiments, the security module is associated with a serial communications node. The error-signal may comprise a node-identifier of the serial communications node.
- In one or more embodiments, the error-signal comprises a security-module-identifier of the security module.
- In one or more embodiments, the security module is configured to:
- compare (i) the error-signal that is output to the serial communications bus via the TXD output interface; with (ii) a bus-error-signal that is received via the RXD input interface; and
- output an error-check-signal to the serial communications bus via the TXD output interface, wherein the error-check-signal is indicative of whether or not there is a difference between the error-signal and the bus-error-signal.
- In one or more embodiments, the security module is configured to:
- compare (i) the value of a particular bit position of the error-signal that is output to the serial communications bus via the TXD output interface; with (ii) the value of the same bit position of a bus-error-signal that is received via the RXD input interface; and
- output an error-check-signal to the serial communications bus via the TXD output interface, wherein the error-check-signal is indicative of whether or not there is a difference between the values of the error-signal and the bus-error-signal at the particular bit position.
- In one or more embodiments, the error-check-signal comprises one or more dominant bits if there is a difference between the error-signal and the bus-error-signal.
- The error-signal may comprise: a first-identifier relating to the condition; and a second-identifier relating to the condition. The bus-error-signal may comprise: a bus-first-identifier relating to the condition; and a bus-second-identifier relating to the condition. The error-check-signal may comprise: a first-error-check-signal, which is indicative of whether or not there is a difference between: (i) the first-identifier of the error-signal; and (ii) the bus-first-identifier of the bus-error-signal; and / or a second-error-check-signal, which is indicative of whether or not there is a difference between: (i) the second-identifier of the error-signal; and (ii) the bus-second-identifier of the bus-error-signal.
- The security module may be associated with a serial communications node. The first-identifier may comprise a node-identifier of the serial communications node. The bus-first-identifier may comprise a bus-node-identifier of one or more serial communications nodes. The second-identifier may comprise an error-identifier of one or more conditions that have been violated. The bus-second-identifier may comprise a bus-error-identifier of one or more conditions that have been violated.
- In one or more embodiments, the error-signal comprises a plurality of bit positions. Each of the bit positions may uniquely identify a particular condition or a particular node-identifier.
- In one or more embodiments, the security module is associated with a serial communications node. The error-signal may comprise a node-identifier of the serial communications node. The node-identifier may comprise a plurality of bit positions. Each of the bit positions of the node-identifier may uniquely identify a particular node. The error-signal may comprise an error-identifier of one or more s that have been violated. The error-identifier may comprise a plurality of bit positions. Each of the bit positions of the error-identifier may uniquely identify a particular condition.
- In one or more embodiments, the error-signal comprises a plurality of bit positions. The error-signal may comprise a dominant bit value at a predetermined bit position.
- In one or more embodiments, the predetermined bit position is the first bit position.
- In one or more embodiments, the serial communications device in a CAN XL node. The serial communications bus may be a CAN XL bus.
- According to a further aspect of the invention, there is provided a method of outputting an error-signal to a serial communications bus, the method comprising:
- receiving a message from the serial communications bus;
- comparing the message with one or more conditions; and
- upon detection that a condition has been violated, outputting an error-signal to the serial communications bus, wherein the error-signal identifies one or more parameters relating to the condition.
- While the disclosure is amenable to various modifications and alternative forms, specifics thereof have been shown by way of example in the drawings and will be described in detail. It should be understood, however, that other embodiments, beyond the particular embodiments described, are possible as well. All modifications, equivalents, and alternative embodiments falling within the spirit and scope of the appended claims are covered as well.
- The above discussion is not intended to represent every example embodiment or every implementation within the scope of the current or future Claim sets. The figures and Detailed Description that follow also exemplify various example embodiments. Various example embodiments may be more completely understood in consideration of the following Detailed Description in connection with the accompanying Drawings.
- One or more embodiments will now be described by way of example only with reference to the accompanying drawings in which:
-
Figure 1 shows a CAN network; -
Figure 2 shows an expanded view of a CAN node; -
Figure 3 shows a Classical CAN frame and a CAN-FD frame in base frame format; -
Figure 4A shows a CAN node including a security module according to an embodiment of the disclosure; -
Figure 4B shows a CAN node including another security module according to an embodiment of the disclosure; -
Figure 5 illustrates a first example of data that can be put onto a serial communications bus according to an embodiment of the disclosure; -
Figure 6 illustrates a second example of data that can be put onto a serial communications bus according to an embodiment of the disclosure; -
Figure 7 illustrates a third example of data that can be put onto a serial communications bus according to an embodiment of the disclosure; -
Figure 8 illustrates a fourth example of data that can be put onto a serial communications bus according to an embodiment of the disclosure; -
Figure 9 illustrates a fifth example of data that can be put onto a serial communications bus according to an embodiment of the disclosure; and -
Figure 10 illustrates an example method according to an embodiment of the disclosure. -
Figure 1 depicts aCAN network 100 that includesmultiple CAN nodes 102, also referred to as ECUs, each connected to aCAN bus 104. In the embodiment ofFigure 1 , each CANnode 102 includes aCAN transceiver 120, alocal controller 110, or microcontroller, having an embeddedCAN protocol controller 114. Thelocal controllers 110 are typically connected to at least one device (not shown) such as a sensor, an actuator, or some other control device and are programmed to determine the meaning of received messages and to generate appropriate outgoing messages. The local controllers may also be referred to as host processors, hosts, or digital signal processors (DSPs). In some examples, the host supports application software that interacts with theCAN protocol controller 114. - The
CAN protocol controllers 114, which can be embedded within thelocal controllers 110 or external to the local controllers (e.g., a separate IC device), implement data link layer operations. For example, in receive operations, aCAN protocol controller 114 stores received serial bits from thetransceiver 120 until an entire message is available for fetching by thelocal controller 110. TheCAN protocol controller 114 can also decode CAN messages according to the standardized frame formats of the CAN protocol. In transmit operations, theCAN protocol controller 114 receives messages from the local controller and transmits the messages as serial bits in one of the CAN frame formats to theCAN transceiver 120. - The
CAN transceivers 120 are located between theCAN protocol controllers 114 and theCAN bus 104 and implement physical layer operations. For example, in receive operations, aCAN transceiver 120 converts analog differential signals from the CAN bus to serial digital signals that theCAN protocol controller 114 can interpret. The CAN transceiver also protects theCAN protocol controller 114 from extreme electrical conditions on theCAN bus 104, e.g., electrical surges. In transmit operations, theCAN transceiver 120 converts serial digital bits received from theCAN protocol controller 114 into analog differential signals that are sent on theCAN bus 104. - The
CAN bus 104 carries analog differential signals and includes a CAN high (CANH)bus line 124 and a CAN low (CANL)bus line 126. -
Figure 2 depicts an expanded view of oneCAN node 202. Features ofFigure 2 that are also shown inFigure 1 have been given corresponding reference numbers in the 200 series and will not necessarily be described again here. - The
local controller 210 includes ahost 216, which may be, for example, a software application that is stored in memory of thelocal controller 210 and executed by processing circuits of thelocal controller 210. Thelocal controller 210 and theCAN transceiver 220 of theCAN node 202 are connected between a supply voltage, Vcc, and ground, GND. In some examples, thelocal controller 210 and theCAN transceiver 220 may have different supply voltages. As illustrated inFigure 2 , data communicated from thelocal controller 210 to theCAN transceiver 220 is identified as transmit data (TXD) and data communicated from theCAN transceiver 220 to thelocal controller 210 is referred to as receive data (RXD). Data is communicated to and from the CAN bus via the CANH andCANL bus lines -
Figure 3 depicts the format of an ISO 11898-1 frame 330 (in the classical base frame format (CBFF) or standard format) that is used in CAN normal mode and also the format of an ISO/DIS 11898-1 frame 332 (in the FD base frame format or FBFF) that is used in CAN FD mode. The fields of the CAN normal mode and CAN FD mode frames are defined as follows: - SOF:
- Start of Frame (always dominant)
- IDENTIFIER:
- Identifier Bits, defining the message content
- RTR:
- Remote transmission Request
- IDE:
- ID Extension
- r0:
- Reserved Bit 0 (replaced by FDF in the CAN FD format)
- FDF:
- FD Format (this is the bit distinguishing the frame formats)
- BRS:
- Baud Rate Switch
- ESI:
- Error State Indicator
- DLC:
- Data Length Code
- Data:
- Data Bytes
- CRC:
- Cyclic Redundancy Check
- CRC Del:
- CRC Delimiter (always recessive)
- ACK:
- Acknowledge
- ACK Del:
- Acknowledge Delimiter
- EOF:
- End Of Frame
- There is also another version of the classical frame format, referred to as "classical extended frame format (CEFF)," in which the FDF bit is in the old r1 position, whereas the FDF bit is in the r0 position in CBFF. There is also a "FD extended frame format (FEFF)," where "extended" refers to a 29-bit identifier. Of note, the CAN protocols use the reserved bit (r0 or r1) (also referred to generally as the FDF bit) within a CAN frame to identify a frame as a CAN FD mode frame. In particular, the FDF bit is a 1-bit field that indicates whether the frame is a CAN normal mode frame or a CAN FD mode frame. When the FDF bit is dominant (e.g., low or "0"), the frame is a CAN normal mode frame and when the FDF bit is recessive (e.g., high or "1"), the frame is a CAN FD mode frame. In a CAN normal mode frame, the reserved bits (r0, r1) are always driven dominant to the bus lines.
- CAN messages are broadcast messages and the identifier is unique to the sender CAN node. The CAN protocol controllers of the receiving CAN nodes have identifier filters that are "tuned" to certain identifiers to make sure that the host receives relevant messages and is not bothered with irrelevant messages. Standard CAN frames have an 11-bit IDENTIFIER field to carry an 11-bit identifier and extended CAN frames have a 29-bit IDENTIFIER field to carry a 29-bit identifier. The 29-bit IDENTIFIER field is divided into two sections, an 11-bit base IDENTIFIER field and an 18-bit extended IDENTIFIER field.
- In Classical CAN and CAN FD all receivers of a message will discard the message if there is at least one dominant bit in the end-of-frame field. This allows receivers that have seen errors during decoding to signal their inability to decode and force the transmitter to repeat the message. Furthermore, this mechanism is used by transceivers for which their messages have been spoofed, and other cyber security mechanisms, to invalidate messages that violate a user defined policy.
- In some newer protocol developments, like CAN XL, it is yet not foreseen that messages can be invalidated and thus there won't be any automatic repetition. If repetition is needed, then this may need to be handled on higher protocol layers as it may not be possible on the protocol layer.
-
Figure 4A depicts aCAN node 402 including asecurity module 434 according to an embodiment of the present disclosure. In this embodiment, thesecurity module 460 is provided separately to aCAN transceiver 420 and a CANlocal controller 410. Thesecurity module 460 is located in a data path between theCAN transceiver 420 and the CANlocal controller 410. -
Figure 4B depicts aCAN node 402 including asecurity module 460 according to another embodiment of the present disclosure. In this embodiment, thesecurity module 460 is provided as part of the CANlocal controller 410. For instance, the functionality of thesecurity module 460 can be provided by a CAN protocol controller. - In a further still embodiment, the functionality of the
security module 460 can be provided by theCAN transceiver 420. This can improve the security of the network even further. - The
CAN node 402 includes aCAN transceiver 420 and alocal CAN controller 410 as described above with reference toFigures 1 and2 . TheCAN transceiver 420 is connected to aCAN bus 404. - The
CAN bus 404 is an example of a serial communications bus, theCAN node 402 is an example of a serial communications device / node, and theCAN transceiver 420 is an example of a serial communications transceiver. It will be appreciated that examples disclosed herein can relate to a Classical CAN node, a CAN FD node, a CAN XL node, or any other CAN node that satisfies an associated CAN standard, either now or in the future. It will also be appreciated embodiments of the security module that are described herein are not limited to CAN protocols, as they can be used with other serial communications protocols / networks such as LIN. - In this example, the
security module 434 is shown separately from theCAN transceiver 420 and thelocal controller 410. It will be appreciated that in other examples the functionality of thesecurity module 434 can be provided by theCAN transceiver 420 and / or thelocal controller 410. - The
security module 434 includes a receive data, RXD,input interface 436 for receiving data from theCAN bus 404. Thesecurity module 434 also includes a transmit data, TXD,output interface 438 for transmitting data to theCAN bus 404. Thesecurity module 434 can receive a message from theCAN bus 404 via theRXD input interface 436, and compare the message with one or more conditions. The conditions can include one or more of form errors, stuff errors and policy violations, as non-limiting examples. For instance a policy may be violated if the security module determines that the CAN message is being spoofed. Various types of form errors and stuff errors are known in the art. - If the
security module 434 detects that a condition has been violated, then it can output an error-signal to theCAN bus 404 via theTXD output interface 438. In this way, thesecurity module 434 can perform one or more of: identifying form errors and / or stuff errors; and determining that a policy has been violated. - The error-signal identifies one or more parameters relating to the condition. That is, the error-signal comprises information about the error signal, such that it is more than a mere binary flag that indicates only whether or not a condition has been violated. The inclusion of such error information in a serial communications protocol, such as CAN, goes against the teachings in the art. This is because known serial communications protocols do not allow the inclusion of such information on the serial communications bus. Therefore, any attempt to go against these teachings of the prior art would result in the rules of the protocol not being satisfied.
- By way of example, in the current CAN and CAN FD protocols such information would be invalidated by other nodes that immediately react with an error flag after receiving the first dominant bit of information in the EOF field. Simple signalling of acknowledge and also "negative acknowledge" (n-ack) are known also in other serial communication protocols. Sending information about the reason for a negative acknowledge triggered from a lower OSI layer, not involving higher (software) layers has advantages from a security perspective, as the lower (hardware) layer cannot be hacked. Also, the ability of the legitimate sender node to signal instantaneously whether the information (associated with the negative acknowledge) it has received has been modified / spoofed due to it violating a policy is also advantageous.
- One or more of the examples described herein can be beneficial over solutions that require the interaction of the lower and higher layers of the protocol; where the lower layer reports the reason for the n-ack to a higher layer, which then in turn can trigger a next message that conveys the information. This would require more bandwidth and add to the reaction time after an incident has happened.
- The error-signal of the present disclosure can include an error-identifier of one or more conditions that have been violated. In this way, an example of a parameter is a reason that an error-signal has been generated. Alternatively or additionally, the error-signal can include a security-module-identifier of the security module that has detected that one or more conditions have been violated. In some examples, the identifier may be a node-identifier of the
CAN node 420 with which thesecurity module 434 is associated. In this way, another example of a parameter is the originator of the error-signal. In some examples, any of these parameters can take one of at least three different values - that is, they are more than mere binary flags. As will be discussed in detail below, this can be embodied by using digital error-signals that include a plurality of bit positions. - In some examples, as will be described below, the
security module 434 can output an error-check-signal on to theCAN bus 404, which may be a bit field at the end of the frame such as after the error-signal. The error-check-signal can indicate the authenticity of a bus-error-signal on theCAN bus 404. As will be described in detail below, the bus-error-signal is a combination of all of the error-signals that have been put onto theCAN bus 404 by individual CAN nodes. Since it is possible that an error-signal from one node can overwrite some or all of an error-signal from another node, the error-check-signal can advantageously provide an indicator as to whether or not any such over-writing (or other manipulation) of an original error-signal has occurred. - The following examples relate to a serial communication protocol where a security module associated with a node can receive data from a serial communications bus at a RXD input interface, and can transmit data to the serial communications bus via a TXD output interface. Messages on the serial communications bus have an end-of-frame field. In the EOF field the bit timing can be the bit timing of an arbitration phase. The behaviour of the physical layer is as in the arbitration phase; so dominant bits ("0") overwrite recessive bits ("1"). This information can be sent by multiple nodes. The information and its usage can be defined by the user. What is important is that the message can be discarded on the data link layer and the information can be handed to higher protocol layers.
-
Figure 5 showsdata 539 that a node sends on to a serial communications bus. Thedata 539 includes amessage 540 that comprises message bits "x", and an EOF (end of frame field) with recessive bits "e". In this example, the recessive bits are 1s. -
Figure 5 also showsdata 541 that is put on to the serial communications bus bynode 5, which is a different node to the one that sent themessage 540.Node 5 has a security module that has compared the receivedmessage 540 with one or more conditions, in this example security policies, and detected that a security policy has been violated. In this example,node 5 has determined that security policy number 7 has been violated. That is, the receivedmessage 540 does not satisfy policy number 7. Policy number 7 may be specific tonode 5, or may be a generic policy that applies to multiple nodes, possibly all of the nodes.Node 5 therefore outputs an error-signal 543 to the serial communications bus. - The error-
signal 543 comprises a node-identifier 544 that is associated with the serial communications node that detected the condition. In this example, the node-identifier 544 is a binary representation of 5; that is the identification number ofnode 5. In this way, the identifier of the node (or security module) that detected the violation of the error signal is an example of a parameter relating to the error. - The error-
signal 543 also comprises an error-identifier 545 that is associated with the condition that has been violated. In this example, condition number 7 has been violated and the error-identifier 545 is a binary representation of 7. In this way, the identifier of the condition that has been violated is an example of a parameter relating to the condition. -
Node 5 also provides an optional error-check-signal 546 to the bus, which will be discussed in more detail with reference to later examples. After the error-check-signal 546,node 5 puts recessive bits 1s on the bus to indicate that it is ready to receive or send a new message. -
Figure 5 shows theresultant data 542 on the serial communications bus, which includes a bus error-signal 555. The bus error-signal 555 includes a bus-node-identifier 552 and a bus-error-identifier 553. In this example it is a combination of themessage 540, the error-signal 543 and the error-check-signal 546. - By accessing the
data 542 on the serial communications bus, all nodes can determine that: - a) the message must be discarded, because there are dominant bits in the EOF;
- b) the discard was requested by node 5 (because of the value of the bus-node-identifier 552);
- c) the reason to discard is number 7 (because of the value of the bus-error-identifier 553);
-
Figure 6 showsdata 639 that a node sends on to a serial communications bus. In the same way asFigure 5 , thedata 639 includes amessage 640. -
Figure 6 also showsdata 641 that is put on to the serial communications bus bynode 5.Node 5 outputs an error-signal 643 to the serial communications bus, in the same way as forFigure 5 . That is,Node 5 has again determined that condition number 7 has been violated. The error signal includes a node-identifier 644 and an error-identifier 645. -
Figure 6 also showsdata 647 that is put on to the serial communications bus bynode 3, which is again a different node to the one that sent themessage 640.Node 3 has a security module that has compared the receivedmessage 640 with one or more conditions and has also detected that condition number 7 has been violated.Node 3 therefore outputs an error-signal 648 to the serial communications bus. The error-signal 648 includes a node-identifier 649 that identifiesnode 3 as the node that detected the condition, and also includes an error-identifier 650 that is associated with condition number 7. -
Figure 6 shows theresultant data 642 on the serial communications bus. In this example it is a combination of themessage 640, the error-signal 643 provided bynode 5, and the error-signal 648 provided bynode 3. It is recalled that 0 is dominant over 1 in the protocol of this example, and therefore for bit positions in the two error-signals wherenodes - In this example, the second and third positions of the node-
identifier 644 ofnode 5 and the node-identifier 649 ofnode 3 are different. When these node-identifiers are combined on the bus, it results in a bus-node-identifier 652 of 0001, which is a binary representation ofdecimal 1. Therefore, the bus-node-identifier 652 does not correctly reflect which nodes have detected the error. - In this example, both
node 3 andnode 5 have detected the same error. Therefore, the error-identifier 645 that was provided bynode 5 is the same as the error-identifier 653 that was provided bynode 3. When these error-identifiers are combined on the bus, it results in a bus-error-identifier 653 which correctly reflects the condition that has been violated. - The bus-node-
identifier 652 and the bus-error-identifier 653 can together be referred to as a bus error-signal 655. -
Node 5 also provides an error-check-signal 646 to the bus. Similarly,node 3 provides an error-check-signal 651 to the bus. As will now be discussed, security modules associated with each of the node sets their error-check-signals signal 655 on the bus correctly reflects the locally generated error-signal - The security module associated with
node 5 can compare (i) the error-signal 643 that it outputs to the bus via its TXD output interface; with (ii) the bus-error-signal 655 that it receives via its RXD input interface. The security module can then output the error-check-signal 646 to the bus via the TXD output interface. The error-check-signal 646 is indicative of whether or not there is a difference between the locally generated error-signal 643 and the bus-error-signal 655. In this example, an error-check-signal 646 comprises one or more dominant bits if there is a difference between the error-signal 643 and the bus-error-signal 655. - The error-
signals Figure 6 identify both a first parameter and a second parameter relating to the condition. The first parameter is an identifier of the node that detected the violation of the error, and is represented by the node-identifiers identifiers signal 655 includes the bus-node-identifier 652 and the bus-error-identifier 653. - The security module associated with
node 5 can compare the locally generated node-identifier 644 with the bus-node-identifier 652, and can also separately compare the locally generated error-identifier 645 with the bus-error-identifier 653. As will be discussed below, the security module can provide the results of these separate comparisons in the error-check-signal 646 such that they are discernible from each other-for example by including the information at predetermined bit positions. The other nodes in the network can then correctly interpret the information at these bit positions because they are also programmed in accordance with the predetermined bit positions. - More generally, the error-check-
signal 646 can comprise a first-error-check-signal, which is indicative of whether or not there is a difference between a first-identifier of the error-signal and a bus-first-identifier of the bus-error-signal. In this example, the first-identifier of the error-signal is a node-identifier, the bus-first-identifier is the bus-node-identifier, and the first-error-check-signal is implemented as the first bit-position of the error-check-signal 646. Similarly, the error-check-signal 646 can comprise a second-error-check-signal, which is indicative of whether or not there is a difference between a second-identifier of the error-signal and a bus-second-identifier of the bus-error-signal. In this example, the second-identifier of the error-signal is an error-identifier, the bus-second-identifier is the bus-error-identifier, and the second-error-check-signal is implemented as the second bit-position of the error-check-signal 646. - In the example of
Figure 6 ,node 5 determines that there is a difference between its locally generated node-identifier 644 and the bus-node-identifier 652, and therefore sets the first bit value of the error-check-signal 646 as a dominant 0.Node 5 also determines that its locally generated error-identifier 645 is the same as the bus-error-identifier 653, and therefore sets the second bit value of the error-check-signal 646 as a recessive 1. -
Node 3 determines that there is a difference between its locally generated node-identifier 649 and the bus-node-identifier 652, and therefore sets the first bit value of the error-check-signal 651 as a dominant 0.Node 3 also determines that its locally generated error-identifier 650 is the same as the bus-error-identifier 653, and therefore sets the second bit value of the error-check-signal 651 as a recessive 1. - When the two error-check-
signals signal 654 which indicates that: the bus-node-identifier 652 does not accurately reflect which node detected the violation of the condition; and (ii) the bus-error-identifier 653 does accurately reflect the identity of the condition that has been violated. - By accessing the
data 642 on the serial communications bus, all nodes can determine that: - a) the message must be discarded, because there are dominant bits in the EOF;
- b) the discard was requested by unknown nodes (even though the bus-node-
identifier 652 suggests thatnode 1 detected the violation of the condition, the fact that the first bit of the bus-error-check-signal 654 is a dominant 0 will cause the nodes to ignore the bus-node-identifier 652); - c) the reason to discard is number 7 (because of the value of bus-error-
identifier 653, and because the second bit of the error-check-signal is a recessive 1); and - d) part of the information in the bus-error-
signal 655 was changed (because the error-check-signal includes a dominant 0). -
Figure 7 showsdata 739 that a node sends on to a serial communications bus. In the same way asFigure 6 , thedata 739 includes amessage 740. -
Figure 7 also showsdata 741 that is put on to the serial communications bus bynode 5.Node 5 outputs the same error-signal 743 as that shown forFigure 6 . -
Figure 7 also showsdata 747 that is put on to the serial communications bus bynode 3.Node 3 outputs an error-signal 748 to the serial communications bus. The error-signal 748 includes the same node-identifier 749 as shown inFigure 6 , but a different error-identifier 750. In this example, the error-identifier 750 is associated withcondition number 1. -
Figure 7 shows theresultant data 742 on the serial communications bus. In this example, the second and third positions of the error-identifier 745 ofnode 5 and the error-identifier 750 ofnode 3 are different. When these error-identifiers identifier 753 of 0001, which is a binary representation ofdecimal 1. Therefore, the bus-error-identifier 753 does not correctly reflect the conditions that have been violated. - In the same way as described with reference to
Figure 6 , the bus-node-identifier 752 also does not correctly reflect which nodes have detected the error. -
Node 5 provides an error-check-signal 746 to the bus. This error-check-signal 746 includes a first-error-check-signal (at the first bit position), which indicates that there is a difference between its locally generated node-identifier 744 and the bus-node-identifier 752. The error-check-signal 746 also includes a second-error-check-signal (at the second bit position), which indicates that there is a difference between its locally generated error-identifier 745 and the bus-error-identifier 753. -
Node 3 also provides an error-check-signal 751 to the bus. This error-check-signal 751 includes a first-error-check-signal (at the first bit position), which indicates that there is a difference between its locally generated node-identifier 749 and the bus-node-identifier 752. The error-check-signal 751 also includes a second-error-check-signal (at the second bit position), which indicates that its locally generated error-identifier 750 is the same as the bus-error-identifier 753. - When the two error-check-
signals signal 754 which indicates that: the bus-node-identifier 752 does not accurately reflect which node detected the violation of the condition; and (ii) the bus-error-identifier 753 does not accurately reflect the identity of the condition that has been violated. - By accessing the
data 742 on the serial communications bus, all nodes can determine that: - a) the message must be discarded, because there are dominant bits in the EOF;
- b) the discard was requested by unknown nodes (because the first bit of the bus-error-check-
signal 754 is a dominant 0); - c) the reason to discard is unknown (because the second bit of the bus-error-check-
signal 754 is a dominant 0); and - d) part of the information in the bus-error-
signal 755 was changed (because the error-check-signal includes a dominant 0). -
Figure 8 showsdata 839 that a node sends on to a serial communications bus. In the same way as earlier figures, thedata 839 includes amessage 840. -
Figure 8 also showsdata 841 that is put on to the serial communications bus bynode 5, and alsodata 847 that is put on to the serial communications bus bynode 3. In this example,nodes signals signals -
Node 5's error-signal 843 includes a node-identifier 844. The node-identifier 844 has six bit positions, which each uniquely identify a particular node. The security module associated with any one node can only set one of the bit positions of the node-identifier 844 to a dominant 0. For instance, a security module associated with a first node can set a first bit position of the node-identifier 844 to a dominant 0 if it detects that a condition has been violated, but it cannot set any of the other bit positions of the of the node-identifier 844. A security module associated with a second node can set a second bit position of the node-identifier 844 to a dominant 0 if it detects that a condition has been violated, but it cannot set any of the other bit positions of the of the node-identifier 844. Et cetera. - As shown in
Figure 8 , the fifth bit position of the node-identifier 844 has been set to a dominant 0 to indicate thatnode 5 has detected the error. -
Node 5's error-signal 843 also includes an error-identifier 845. The error-identifier 845 has eight bit positions, which each uniquely identify a particular condition that can be detected. A security module can set one or more of the bit positions of the error-identifier 845 to a dominant 0 if it detects the violation of an associated condition. For instance, if a security module detects violation of a first condition then it sets the first bit position of the error-identifier 845 to a dominant 0. If a security module detects violation of a second condition then it sets the second bit position of the error-identifier 845 to a dominant 0. Et cetera. - As shown in
Figure 8 , the seventh bit position of the error-identifier 845 has been set to a dominant 0 to indicate that condition 7 has been violated. -
Node 3's error-signal 848 also includes a node-identifier 849 and an error-identifier 850. As shown inFigure 8 , the third bit position of the node-identifier 849 has been set to a dominant 0 to indicate thatnode 3 has detected the error. The first bit position of the error-identifier 850 has been set to a dominant 0 to indicate thatcondition 1 has been violated. -
Figure 8 shows theresultant data 842 on the serial communications bus. In this example when the error-signal 843 provided bynode 5 is combined with the error-signal 848 provided bynode 3, the resultant bus-error-signal 855 retains identifiers of which nodes detected errors and which errors were detected. - One or more of the nodes can store a correlation between the bit position in a node-identifier and an identifier of the associated node. In some examples, this can enable a node to take remedial action that is specific to the node that detected the error. One or more of the nodes can also store a correlation between the bit position in an error-
identifier 845 and an identifier of an associated condition. In some examples, this can enable a node to take remedial action that is specific to the errors that have been detected. Examples of remedial action that can be taken are described in more detail below. - In this example, the error-check-
signals signals signals signal signal 855 that it receives via its RXD input interface. - In relation to the node-
identifier 844 ofnode 5's error-signal 843, the 5th bit position of the node-identifier 844 is uniquely associated withnode 5. Therefore, no other node should be able to set the 5th bit position of the bus-node-identifier 852 of the error-signal 855 on the bus. In order to determine whether or not to set the first bit of the error-check-signal 846,node 5 compares (i) the value of the 5th bit position of the node-identifier 844; with (ii) the value of the 5th bit position of the bus-node-identifier 852. As shown inFigure 8 , the 5th bit position of both the node-identifier 844 and the bus-node-identifier 852 is a 0. Therefore, the node determines that the value that it has put onto the bus for its unique bit position in the node-identifier 844 is accurately reflected in the bus-node-identifier 852, and it sets the first bit of the error-check-signal 846 as 1. If the node determined that the value that it had put onto the bus for its unique bit position in the node-identifier 844 was not accurately reflected in the bus-node-identifier 852, then it would set the first bit of the error-check-signal 846 as a dominant 0. - Similarly,
node 3 determines that the value of the 3rd bit of its node-identifier 849 correctly matches the value of the 3rd bit of the bus-node-identifier 852 and therefore also sets the first bit of its error-check-signal 851 as 1. - If any node detects a dominant 0 in the first bit position of the bus-error-check-
signal 854, then the nodes can take any of the actions described elsewhere in this document in relation to the detection of a dominant 0 in an error-check-signal. - Optionally, the second bit position of the error-check-
signals identifiers signals - In other examples, the error-check-
signals signal 855. - By accessing the
data 842 on the serial communications bus, all nodes can determine that: - a) the message must be discarded, because there are dominant bits in the EOF;
- b) the discard was requested by
nodes 3 and 5 (the dominant bits in the bus-node-identifier 852 indicatenodes 3 and 5); and - c) the reasons to discard are 1 and 7 (the dominant bits in the bus-error-
identifier 853 indicatenodes 3 and 5). - d) information that was put onto the bus by the nodes has not been lost, nor has any node been incorrectly identified as putting an error-signal onto the bus when it didn't, thus no modification is flagged as the relevant dominant bits in the bus-error-
signal 855 are preserved (the 2 bits of the bus-error-signal are recessive 1). - Optionally, a bus-error-check-
signal 854 can be used to indicate whether or not a modification has been made to an error-signal that has been sent by a security module, which can be used as a flag that indicates that more than one node is sending an error-signal. -
Figure 9 is an example that is very similar toFigure 8 . The only difference between the two examples is that inFigure 9 the error-signals predetermined bit position 956. InFigure 9 , thepredetermined bit position 956 is the first bit position, and can be considered as representing an error-flag. - The error-flag does not identify the node that detected the error, nor does it indicate the condition that has been violated. Instead, the error-flag can be considered as putting the nodes in the network on notice that an error has been detected and that further information about one or more parameters relating to the condition will follow.
- Use of such an error-flag can be advantageous where the number of bits in an error-signal is high, and thus in a worst case scenario the first dominant bit in the error-signal could occur later than the end of the EOF field. By which time the nodes in the network may have assumed that no error has been detected and therefore they may have processed the
message 940. The error-flag can be included at anypredetermined bit position 956 that is before the end of the EOF field for a particular protocol. The error-flag is only set to a dominant value by a node if there will be subsequent dominant bits in the error-signal. - A further advantage of the error-flag is that it can help to ensure better synchronicity of senders and receivers on the bus.
- For any of the examples disclosed herein, upon the detection of an error, the security module or an associated controller may perform one or more of the following remedial actions:
- 1. if the security module is associated with the node that sent the message that caused the error, then the node might need to be reset / re-boot to avoid further violation.
- 2. logging that an error has been detected, and optionally storing one or more parameters relating to the condition such as node-identifiers / error-identifiers. The logged information may be accessed by the node or a network operator for future analysis.
- 3. alerting or displaying an error to a network operator that an error has been detected. The network operator may take appropriate further action such as shutting down the network, enabling a safety mode of one or more nodes in the network.
- 4. The security module that detected the error, or an associated local controller, may put its node into an emergency mode or safe mode. This may include disabling, limiting or denying access to certain features.
- 5. The local controller may automatically send a message to one or more other nodes or the network. The message may alert the nodes or network to the detected error and / or put one or more nodes into an emergency mode
- As indicated above, in some examples the remedial action that is taken can be automatically selected by a processor or module based on a bus-node-identifier and / or a bus-error-identifier (or more generally a bus-error-signal).
- Examples described herein can add a signalling at the end of a serial data frame that is used to force all receivers to discard the message, whereby the sender of such discard signal may be different from the sender of the serial data frame. The sender of the discard signal can encode the reason why the message is to be discarded into the discard signal and can flag modifications of the discard signal by e.g. rogue nodes.
-
Figure 10 illustrates an example embodiment of a method of outputting an error-signal to a serial communications bus. As discussed above, the serial communications bus may or may not be a CAN XL bus. - At
step 1090, the method comprises receiving a message from the serial communications bus (404). The message can be sent by any node on the bus. The method can involve determining whether or not the received message was sent from the local host or not. If the message was sent by the local host / node, then it may apply different or additional conditions than would be the case if the message had been received by a remote host / node. For instance, one or more policies may only be checked to see if they have been violated for a remotely received message that has the identifier of the local host / node. - At
step 1092, the method includes comparing the message with one or more conditions. As described above, such conditions can relate to stuff errors, form errors, intrusion errors, scheduling errors, policy violations, or any other types of error / policies that are known in the art. - Upon detection that a condition has been violated, at
step 1094 the method comprises outputting an error-signal to the serial communications bus. As described throughout this document, the error-signal identifies one or more parameters relating to the condition, which can include an identifier of a node that has detected the error and / or an identifier of the condition that has been violated. - One or more of the examples disclosed herein can provide a mechanism to invalidate a frame / message by a cyber or safety function, where one does not already exist, such as in CAN XL. Also, examples described herein can provide a mechanism for identifying which node detected an error and / or for what reason the message shall be discarded to receivers and transmitters on a serial communications network.
- In certain applications, one or more of the following features / results can be provided / achieved:
- 1. A CAN XL node can discard a CAN XL message, when defined bits in the end-of-frame field (EOF) are received dominant.
- 2. A node receiving dominant bits in the EOF after a CAN XL frame may not send a reactive error flag, as it would do after a Classical or CAN FD message.
- 3. The discard signal can comprise a certain number of bits in which information e.g. sender ID, sending reason are encoded. The start of the discard signal can be at a defined bit position in the EOF.
- 4. A node sending the discard signal can append several bits that shall be sent recessive when the information encoded are read back unchanged. In case the information read back differs from what is sent one or more of the appended bits can be send dominant. This is to flag modifications that may be caused by rogue nodes, or an overlay of different nodes sending a discard signal.
- 5. All nodes can read the bits in the EOF and provide those to higher protocol layers.
- The instructions and/or flowchart steps in the above figures can be executed in any order, unless a specific order is explicitly stated. Also, those skilled in the art will recognize that while one example set of instructions/method has been discussed, the material in this specification can be combined in a variety of ways to yield other examples as well, and are to be understood within a context provided by this detailed description.
- In some example embodiments the set of instructions/method steps described above are implemented as functional and software instructions embodied as a set of executable instructions which are effected on a computer or machine which is programmed with and controlled by said executable instructions. Such instructions are loaded for execution on a processor (such as one or more CPUs). The term processor includes microprocessors, microcontrollers, processor modules or subsystems (including one or more microprocessors or microcontrollers), or other control or computing devices. A processor can refer to a single component or to plural components.
- In other examples, the set of instructions/methods illustrated herein and data and instructions associated therewith are stored in respective storage devices, which are implemented as one or more non-transient machine or computer-readable or computer-usable storage media or mediums. Such computer-readable or computer usable storage medium or media is (are) considered to be part of an article (or article of manufacture). An article or article of manufacture can refer to any manufactured single component or multiple components. The non-transient machine or computer usable media or mediums as defined herein excludes signals, but such media or mediums may be capable of receiving and processing information from signals and/or other transient mediums. Example embodiments of the material discussed in this specification can be implemented in whole or in part through network, computer, or data based devices and/or services. These may include cloud, internet, intranet, mobile, desktop, processor, look-up table, microcontroller, consumer equipment, infrastructure, or other enabling devices and services. As may be used herein and in the claims, the following non-exclusive definitions are provided.
- In one example, one or more instructions or steps discussed herein are automated. The terms automated or automatically (and like variations thereof) mean controlled operation of an apparatus, system, and/or process using computers and/or mechanical/electrical devices without the necessity of human intervention, observation, effort and/or decision.
- It will be appreciated that any components said to be coupled may be coupled or connected either directly or indirectly. In the case of indirect coupling, additional components may be located between the two components that are said to be coupled.
- In this specification, example embodiments have been presented in terms of a selected set of details. However, a person of ordinary skill in the art would understand that many other example embodiments may be practiced which include a different selected set of these details. It is intended that the following claims cover all possible example embodiments.
Claims (15)
- A security module (434) for a serial communications device, the security module (434) comprising:a receive data, RXD, input interface (436) for receiving data from a serial communications bus (404);a transmit data, TXD, output interface (438) for transmitting data to the serial communications bus (404);wherein the security module (434) is configured to:receive a message (540) from the serial communications bus (404) via the RXD input interface (436);compare the message (540) with one or more conditions; andupon detection that a condition has been violated, output an error-signal (543) to the serial communications bus (404) via the TXD output interface (438), wherein the error-signal (543) identifies one or more parameters relating to the condition.
- The security module (434) of claim 1, wherein the one or more parameters relating to the condition can take one of at least three different values.
- The security module (434) of claim 1 or claim 2, wherein the error-signal (543) comprises an error-identifier (545) of one or more conditions that have been violated.
- The security module (434) of any preceding claim, wherein the security module (434) is associated with a serial communications node (402), and the error-signal (543) comprises a node-identifier (544) of the serial communications node (402).
- The security module (434) of any preceding claim, wherein the error-signal (543) comprises a security-module-identifier of the security module (434).
- The security module (434) of any preceding claim, wherein the security module (434) is configured to:compare (i) the error-signal (643) that is output to the serial communications bus (404) via the TXD output interface (438); with (ii) a bus-error-signal (655) that is received via the RXD input interface (436); andoutput an error-check-signal (646) to the serial communications bus (404) via the TXD output interface (438), wherein the error-check-signal (646) is indicative of whether or not there is a difference between the error-signal (643) and the bus-error-signal (655).
- The security module (434) of claim 6, wherein the error-check-signal (646) comprises one or more dominant bits if there is a difference between the error-signal (643) and the bus-error-signal (655).
- The security module (434) of claim 6 or claim 7, wherein:the error-signal (643) comprises: a first-identifier (644) relating to the condition; and a second-identifier (645) relating to the condition;the bus-error-signal (655) comprises: a bus-first-identifier (652) relating to the condition; and a bus-second-identifier (653) relating to the condition; andthe error-check-signal (646) comprises:a first-error-check-signal, which is indicative of whether or not there is a difference between: (i) the first-identifier (644) of the error-signal (643); and (ii) the bus-first-identifier (652) of the bus-error-signal (655); anda second-error-check-signal, which is indicative of whether or not there is a difference between: (i) the second-identifier (645) of the error-signal (643); and (ii) the bus-second-identifier (653) of the bus-error-signal (655).
- The security module (434) of claim 8, wherein:the security module (434) is associated with a serial communications node (402);the first-identifier (644) comprises a node-identifier (644) of the serial communications node (402);the bus-first-identifier (652) comprises a bus-node-identifier (652) of one or more serial communications nodes (402);the second-identifier (645) comprises an error-identifier of one or more conditions that have been violated; andthe bus-second-identifier (653) comprises a bus-error-identifier of one or more conditions that have been violated.
- The security module (434) of any preceding claim, wherein the error-signal (843) comprises a plurality of bit positions, and wherein each of the bit positions uniquely identifies a particular condition or a particular node-identifier.
- The security module (434) of claim 10, wherein:the security module (434) is associated with a serial communications node (402),the error-signal (843) comprises a node-identifier (844) of the serial communications node (402);the node-identifier (844) comprises a plurality of bit positions;each of the bit positions of the node-identifier (844) uniquely identifies a particular node;the error-signal (843) comprises an error-identifier (845) of one or more s that have been violated;the error-identifier (845) comprises a plurality of bit positions;each of the bit positions of the error-identifier (845) uniquely identifies a particular condition.
- The security module (434) of any preceding claim, wherein the error-signal (943) comprises a plurality of bit positions, and wherein the error-signal (943) comprises a dominant bit value at a predetermined bit position (956).
- The security module (434) of claim 12, wherein the predetermined bit position (956) is the first bit position.
- The security module (434) of any preceding claim, wherein:the serial communications device in a CAN XL node; andthe serial communications bus (404) is a CAN XL bus.
- A method of outputting an error-signal (543) to a serial communications bus, the method comprising:receiving a message (540) from the serial communications bus (404);comparing the message (540) with one or more conditions; andupon detection that a condition has been violated, outputting an error-signal (543) to the serial communications bus (404), wherein the error-signal (543) identifies one or more parameters relating to the condition.
Priority Applications (3)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
EP19190344.2A EP3772839B1 (en) | 2019-08-06 | 2019-08-06 | Security module for a serial communications device |
CN202010739897.5A CN112347021B (en) | 2019-08-06 | 2020-07-28 | Security module for serial communication device |
US16/984,699 US11463198B2 (en) | 2019-08-06 | 2020-08-04 | Security module for a serial communications device |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
EP19190344.2A EP3772839B1 (en) | 2019-08-06 | 2019-08-06 | Security module for a serial communications device |
Publications (2)
Publication Number | Publication Date |
---|---|
EP3772839A1 true EP3772839A1 (en) | 2021-02-10 |
EP3772839B1 EP3772839B1 (en) | 2023-01-04 |
Family
ID=67658490
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
EP19190344.2A Active EP3772839B1 (en) | 2019-08-06 | 2019-08-06 | Security module for a serial communications device |
Country Status (3)
Country | Link |
---|---|
US (1) | US11463198B2 (en) |
EP (1) | EP3772839B1 (en) |
CN (1) | CN112347021B (en) |
Cited By (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US11038714B2 (en) | 2019-05-29 | 2021-06-15 | Nxp B.V. | Controller area network transceiver |
US11595412B2 (en) * | 2019-10-17 | 2023-02-28 | Volvo Car Corporation | Detecting manipulation of data on a can bus |
Families Citing this family (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP3772841B1 (en) | 2019-08-06 | 2023-06-14 | Nxp B.V. | A security module for a can node |
EP3772840B1 (en) | 2019-08-06 | 2023-03-15 | Nxp B.V. | A security module for a can node |
CN110808891B (en) * | 2019-09-30 | 2021-10-12 | 深圳市道通合创新能源有限公司 | CAN filter merging method and device and CAN controller |
Citations (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP2985955A1 (en) * | 2014-08-15 | 2016-02-17 | Nxp B.V. | Controller area network (can) device and method for emulating classic can error management |
US20180152472A1 (en) * | 2015-09-29 | 2018-05-31 | Panasonic Intellectual Property Corporation Of America | Invalidity detection electronic control unit, in-vehicle network system, and communication method |
Family Cites Families (13)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
KR19980057466U (en) * | 1997-02-04 | 1998-10-15 | 정장호 | TD bus matching error detection circuit in all electronic switch |
US7631229B2 (en) * | 2006-04-24 | 2009-12-08 | Freescale Semiconductor, Inc. | Selective bit error detection at a bus device |
DE102011007766A1 (en) * | 2011-04-20 | 2012-10-25 | Robert Bosch Gmbh | Method and device for serial data transmission with switchable data coding |
US9009523B2 (en) * | 2012-11-27 | 2015-04-14 | GM Global Technology Operations LLC | Method and apparatus for isolating a fault in a controller area network |
US20150135271A1 (en) * | 2013-11-11 | 2015-05-14 | GM Global Technology Operations LLC | Device and method to enforce security tagging of embedded network communications |
US9298529B2 (en) * | 2014-05-29 | 2016-03-29 | Freescale Semiconductor, Inc. | Indicating internal transmitter errors in a controller area network (CAN) |
US10528410B2 (en) * | 2014-12-16 | 2020-01-07 | Intel Corporation | Apparatus, method and system to exchange error information in a unified protocol communication |
US9380070B1 (en) * | 2015-01-20 | 2016-06-28 | Cisco Technology, Inc. | Intrusion detection mechanism |
US10361934B2 (en) * | 2015-09-28 | 2019-07-23 | Nxp B.V. | Controller area network (CAN) device and method for controlling CAN traffic |
US20170235698A1 (en) * | 2016-02-12 | 2017-08-17 | Nxp B.V. | Controller area network (can) message filtering |
CN210839619U (en) * | 2017-02-17 | 2020-06-23 | 马维尔亚洲私人有限公司 | System for error recording mechanism |
EP3772841B1 (en) | 2019-08-06 | 2023-06-14 | Nxp B.V. | A security module for a can node |
EP3772840B1 (en) | 2019-08-06 | 2023-03-15 | Nxp B.V. | A security module for a can node |
-
2019
- 2019-08-06 EP EP19190344.2A patent/EP3772839B1/en active Active
-
2020
- 2020-07-28 CN CN202010739897.5A patent/CN112347021B/en active Active
- 2020-08-04 US US16/984,699 patent/US11463198B2/en active Active
Patent Citations (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP2985955A1 (en) * | 2014-08-15 | 2016-02-17 | Nxp B.V. | Controller area network (can) device and method for emulating classic can error management |
US20180152472A1 (en) * | 2015-09-29 | 2018-05-31 | Panasonic Intellectual Property Corporation Of America | Invalidity detection electronic control unit, in-vehicle network system, and communication method |
Non-Patent Citations (2)
Title |
---|
ROBERT BOSCH: "CAN with Flexible Data-Rate Specification Version 1.0", 17 April 2012 (2012-04-17), XP055553306, Retrieved from the Internet <URL:https://web.archive.org/web/20151211125301if_/http://www.bosch-semiconductors.de/media/ubk_semiconductors/pdf_1/canliteratur/can_fd_spec.pdf> [retrieved on 20190207] * |
TSUTOMU MATSUMOTO ET AL: "A Method of Preventing Unauthorized Data Transmission in Controller Area Network", 2012 IEEE 75TH VEHICULAR TECHNOLOGY CONFERENCE (VTC SPRING 2012) : YOKOHAMA, JAPAN, 6 - 9 MAY 2012, IEEE, PISCATAWAY, NJ, 6 May 2012 (2012-05-06), pages 1 - 5, XP032202711, ISBN: 978-1-4673-0989-9, DOI: 10.1109/VETECS.2012.6240294 * |
Cited By (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US11038714B2 (en) | 2019-05-29 | 2021-06-15 | Nxp B.V. | Controller area network transceiver |
US11595412B2 (en) * | 2019-10-17 | 2023-02-28 | Volvo Car Corporation | Detecting manipulation of data on a can bus |
Also Published As
Publication number | Publication date |
---|---|
CN112347021B (en) | 2024-04-09 |
US11463198B2 (en) | 2022-10-04 |
US20210044382A1 (en) | 2021-02-11 |
EP3772839B1 (en) | 2023-01-04 |
CN112347021A (en) | 2021-02-09 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US11463198B2 (en) | Security module for a serial communications device | |
EP3206361B1 (en) | Controller area network (can) message filtering | |
US9935774B2 (en) | Configurable cryptographic controller area network (CAN) device | |
US11888866B2 (en) | Security module for a CAN node | |
US11677779B2 (en) | Security module for a can node | |
EP3148154A1 (en) | Controller area network (can) device and method for controlling can traffic | |
US11190299B2 (en) | Ethernet communication apparatus, and method for recovering error of end node and switch in vehicle | |
US20210173961A1 (en) | Method of Using Protocol CRC to Implement End to End Protection of a CAN Message | |
US20230198800A1 (en) | Apparatus for a controller area network | |
EP4068721B1 (en) | Controller area network device | |
US12028184B2 (en) | Controller area network module and method for the module | |
EP4199434A1 (en) | Apparatus for a controller area network | |
EP4199437A1 (en) | Apparatus for a controller area network | |
EP4304135A1 (en) | Controller area network (can) transceiver, can node, can system and method for the can transceiver | |
US20240097935A1 (en) | Controller area network system and a method for the system | |
CN115955356A (en) | Method, system, equipment and medium for inter-domain secure communication |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
PUAI | Public reference made under article 153(3) epc to a published international application that has entered the european phase |
Free format text: ORIGINAL CODE: 0009012 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: THE APPLICATION HAS BEEN PUBLISHED |
|
AK | Designated contracting states |
Kind code of ref document: A1 Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR |
|
AX | Request for extension of the european patent |
Extension state: BA ME |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: REQUEST FOR EXAMINATION WAS MADE |
|
17P | Request for examination filed |
Effective date: 20210810 |
|
RBV | Designated contracting states (corrected) |
Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR |
|
REG | Reference to a national code |
Ref country code: DE Ref legal event code: R079 Ref document number: 602019023883 Country of ref document: DE Free format text: PREVIOUS MAIN CLASS: H04L0029060000 Ipc: H04L0009400000 |
|
GRAP | Despatch of communication of intention to grant a patent |
Free format text: ORIGINAL CODE: EPIDOSNIGR1 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: GRANT OF PATENT IS INTENDED |
|
RIC1 | Information provided on ipc code assigned before grant |
Ipc: H04L 9/40 20220101AFI20220906BHEP |
|
INTG | Intention to grant announced |
Effective date: 20220929 |
|
GRAS | Grant fee paid |
Free format text: ORIGINAL CODE: EPIDOSNIGR3 |
|
GRAA | (expected) grant |
Free format text: ORIGINAL CODE: 0009210 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: THE PATENT HAS BEEN GRANTED |
|
AK | Designated contracting states |
Kind code of ref document: B1 Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR |
|
REG | Reference to a national code |
Ref country code: GB Ref legal event code: FG4D |
|
REG | Reference to a national code |
Ref country code: CH Ref legal event code: EP |
|
REG | Reference to a national code |
Ref country code: AT Ref legal event code: REF Ref document number: 1542710 Country of ref document: AT Kind code of ref document: T Effective date: 20230115 |
|
REG | Reference to a national code |
Ref country code: DE Ref legal event code: R096 Ref document number: 602019023883 Country of ref document: DE |
|
REG | Reference to a national code |
Ref country code: IE Ref legal event code: FG4D |
|
REG | Reference to a national code |
Ref country code: LT Ref legal event code: MG9D |
|
REG | Reference to a national code |
Ref country code: NL Ref legal event code: MP Effective date: 20230104 |
|
REG | Reference to a national code |
Ref country code: AT Ref legal event code: MK05 Ref document number: 1542710 Country of ref document: AT Kind code of ref document: T Effective date: 20230104 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: NL Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230104 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: RS Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230104 Ref country code: PT Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230504 Ref country code: NO Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230404 Ref country code: LV Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230104 Ref country code: LT Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230104 Ref country code: HR Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230104 Ref country code: ES Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230104 Ref country code: AT Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230104 |
|
P01 | Opt-out of the competence of the unified patent court (upc) registered |
Effective date: 20230725 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: SE Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230104 Ref country code: PL Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230104 Ref country code: IS Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230504 Ref country code: GR Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230405 Ref country code: FI Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230104 |
|
REG | Reference to a national code |
Ref country code: DE Ref legal event code: R097 Ref document number: 602019023883 Country of ref document: DE |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: SM Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230104 Ref country code: RO Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230104 Ref country code: EE Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230104 Ref country code: DK Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230104 Ref country code: CZ Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230104 |
|
PLBE | No opposition filed within time limit |
Free format text: ORIGINAL CODE: 0009261 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: SK Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230104 |
|
PGFP | Annual fee paid to national office [announced via postgrant information from national office to epo] |
Ref country code: FR Payment date: 20230720 Year of fee payment: 5 Ref country code: DE Payment date: 20230720 Year of fee payment: 5 |
|
26N | No opposition filed |
Effective date: 20231005 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: SI Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230104 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: MC Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230104 |
|
REG | Reference to a national code |
Ref country code: CH Ref legal event code: PL |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: MC Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230104 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: LU Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES Effective date: 20230806 |
|
GBPC | Gb: european patent ceased through non-payment of renewal fee |
Effective date: 20230806 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: LU Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES Effective date: 20230806 Ref country code: CH Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES Effective date: 20230831 |
|
REG | Reference to a national code |
Ref country code: BE Ref legal event code: MM Effective date: 20230831 |
|
REG | Reference to a national code |
Ref country code: IE Ref legal event code: MM4A |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: IT Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230104 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: IE Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES Effective date: 20230806 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: GB Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES Effective date: 20230806 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: IE Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES Effective date: 20230806 Ref country code: GB Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES Effective date: 20230806 |